ClaudeMap

Claude Code Security Review

Anthropic's official GitHub Action that reviews PRs for security vulnerabilities with Claude.

Skills & Commandsofficialsecuritycode-reviewgithub-actionsanthropic
Visit projectanthropics/claude-code-security-review

Anthropic's official AI-powered security review GitHub Action. On every PR, Claude analyzes the diff for vulnerability classes — injection, auth and session bugs, secrets handling, unsafe deserialization — and comments with severity-ranked findings and suggested fixes. Complements SAST scanners by reasoning about business-logic risks that rules can't express; instructions and severity thresholds are tunable per repo.

What it does

  • Anthropic's security-review GitHub Action: Claude analyzes PR diffs for vulnerabilities
  • Diff-aware: only scans changed files; comments findings on the PR
  • Also usable as a `/security-review` slash command locally in Claude Code

When to use it

A semantic security pass on every PR — catches what pattern-based SAST misses (broken authz logic, injection via composition) and writes review comments.

Getting started

GitHub Actions — .github/workflows/security.yml needs `permissions: { pull-requests: write, contents: read }`, then a step `uses: anthropics/claude-code-security-review@main` with `claude-api-key: ${{ secrets.CLAUDE_API_KEY }}`. Local usage: the /security-review command in Claude Code.

Things to know

The README itself warns the action is not hardened against prompt injection — use it only on trusted PRs (e.g. require approval for external contributors). Findings still need human triage, and each PR costs API spend.

Repository

anthropics/claude-code-security-review

Charted

Related on the map

  • SureForge

    Skill

    An instruction-only skill that makes agents research before they ask, plan before they build, and verify before they call anything done.

    • workflow
    • verification
    • quality
    • skill
    View

  • guizang-product-video-skill

    Skill

    Guizang's agent skill turns your repo's recent updates into a finished promo video — real components, code-rendered animation, an original code-written soundtrack — no video editor involved.

    • agent-skill
    • video
    • promo
    • marketing
    View

  • geo-sleuth

    Skill

    An agent skill that geolocates a photo with nothing readable in it — OSM geometry, elevation skylines and satellite tiles turn “where was this taken?” into a measured answer with an error radius.

    • agent-skill
    • geolocation
    • osint
    • openstreetmap
    View